4 ms·
A blank font list where? There's no way to get a direct list of fonts: you just try rendering text with a given font and look at the metrics of it versus the fa
by gsnedders 10y ago
A blank font list where? There's no way to get a direct list of fonts: you just try rendering text with a given font and look at the metrics of it versus the fallback. Font lists are done using side-channels (and you also therefore have to have a list of fonts to sniff in the first place).
The only way to stop font-based side-channels is to limit the web to a fixed set of fonts: and that will horribly break the web in some linguistic communities where there's a fair amount of web content that relies on specific fonts (that typically map old Windows codespaces to other characters for support for their language, often before Unicode covered those characters).
You also need identical fonts for a given user agent, and that's very hard to guarantee short of shipping your own fonts (e.g., consider an OS update that changes a font!), and that becomes expensive fast.
- BuuQu9hu 10y agoDisable looking at the metrics of text rendering results?
- gsnedders 10y agoGet two block level elements, render some text in between, and calculate how far apart the two block level elements are, and you can already determine the height of the glyph. So, yeah, to disable that you'd have to entirely disable the CSSOM, which would cause ridiculous amounts of breakage.